Static task
static1
Behavioral task
behavioral1
Sample
3e61b48db033ef0d9d051b2e03afd81d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3e61b48db033ef0d9d051b2e03afd81d_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3e61b48db033ef0d9d051b2e03afd81d_JaffaCakes118
-
Size
241KB
-
MD5
3e61b48db033ef0d9d051b2e03afd81d
-
SHA1
6eb6d4e853d5a5e2c3369f54139d79f847ef459e
-
SHA256
9af0eece22608ba68d0c2c9dfbe703e2c7c22b489d523829371c8830b3ddc1e5
-
SHA512
6bd140bda936bbd927b87be065053671a63b8474f699c5c272ca549662bb2614c3667a48d308f6de1f757e0cb83d3d9f87836047ca2541ef104346f121caa621
-
SSDEEP
3072:L1KTV9DlT/gQcd8CFYz4lcNPzdWBlXSZ9Ysz+N5jWvQ8bPjvtSpYxjFtNSM8Vs1L:gTz3GXOXoXw9YsKjWFbj/NSm1LGtG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e61b48db033ef0d9d051b2e03afd81d_JaffaCakes118
Files
-
3e61b48db033ef0d9d051b2e03afd81d_JaffaCakes118.exe windows:4 windows x86 arch:x86
0480a155f28743e39420036f688c9ad3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
FreeLibrary
GetLocalTime
lstrcpyA
GetModuleHandleA
GetProcAddress
LoadLibraryA
lstrcmpA
GetCommandLineA
GetVersionExA
WideCharToMultiByte
MultiByteToWideChar
GetStartupInfoA
ExitProcess
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
HeapSize
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualProtect
GetSystemInfo
Sections
.text Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 200KB - Virtual size: 199KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ